Little Snitch is becoming much, much less useful with in-app DNS-over-HTTPS resolvers. They really need to provide a local DNS/DoH-to-DoH proxy function so they can sniff the traffic without forcing the user to switch off DoH entitely.
Doesn’t LS let you block internet access per app per domain? At that level of control why would dns resolution bypass matter when I can still block the app from talking to any arbitrary IP?
For this reason I disabled DNS over HTTPS in Firefox. How much protection and what kind of protection does DNS over HTTPS give you?